Anomaly Diagnosis Using Variable Groups for Cause Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anomaly detection methods can effectively identify anomalies but struggle to determine the cause of these anomalies, especially in complex systems like network anomalies, leading to inefficient management of alerts and inability to specify anomalous variables.
Innovation Solution
An anomaly diagnosis apparatus that uses a processor and memory to generate an anomaly detection model through machine learning, identifying groups of variables contributing to anomalies by employing techniques like autoencoders and one-class support vector machines, and calculating scores to determine anomaly presence and cause.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anomaly detection methods are used to identify anomalies in complex systems, then anomaly detection capability is improved, but the ability to determine the cause of anomalies deteriorates
Solution Approach 1:
The patent segments the anomaly analysis process into two distinct stages: first, detecting whether an anomaly exists using anomaly detection models; second, identifying the cause of the anomaly using anomaly diagnosis models that analyze relationships between multiple variables. This segmentation allows each model to specialize in its respective function, improving overall performance while maintaining clear separation of concerns.
Solution Approach 2:
The patent introduces an intermediary component that calculates anomaly scores and variable contribution scores. These scores serve as mediators that bridge the gap between raw observed values and diagnostic conclusions, enabling the system to transition from simple anomaly detection to detailed cause identification through quantitative analysis.
2Measurement precision
If multiple variables are monitored to improve diagnosis accuracy, then anomaly identification precision is improved, but system complexity increases
Solution Approach 1:
The patent transforms the complex multi-variable diagnostic problem into a scoring problem by introducing anomaly scores and variable contribution scores. This parameter transformation simplifies the analysis by converting multiple variable relationships into comparable numerical values that can be systematically evaluated to identify the cause of anomalies.
Solution Approach 2:
The patent replaces complex mechanical analysis of variable relationships with machine learning models that automatically learn and diagnose anomalies. The anomaly diagnosis model uses learned relationships from training data to identify causes, substituting manual or rule-based analysis with automated intelligent systems that handle complexity more efficiently.
3Loss of information
If detailed anomaly cause analysis is performed, then diagnostic capability is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary action by pre-training anomaly diagnosis models using historical data and variable relationships before actual anomaly events occur. This advance preparation enables the model to quickly diagnose new anomalies without performing complex analysis from scratch, significantly reducing processing time while maintaining high diagnostic capability.
Solution Approach 2:
The patent uses training data that copies historical anomaly patterns and normal operation states to create a reference model. This copied knowledge from historical data enables the system to rapidly compare current anomalies against known patterns, reducing the time needed for detailed analysis while maintaining accurate diagnostic capability.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
There is provided an anomaly diagnosis method performed by an anomaly diagnosis apparatus that diagnosis to determine whether an observed value composed of values of variables representing a state of a monitoring target obtained by observing the monitoring target is anomalous. The anomaly diagnosis apparatus includes a processor and a memory. The memory stores an anomaly detection model generated by learning using observed values. The processor acquires group information indicating one or more groups each constituted by a combination of at least two mutually-related variables, acquires the observed value, determines whether the observed value is anomalous by employing the anomaly detection model read from the memory, and in a case where the observed value is determined to be anomalous, identifies a group causing an anomaly among the one or more groups in the observed value.